vault entries are retrieved via puppet apply but not puppet agent

[drdam02]

I installed this backend and configured it according to the docs.

When running puppet apply -e "notice(hiera('its))" I get a correct response

Notice: Scope(Class[main]): atrap
Notice: Compiled catalog for server.domain.be in environment production in 0.47 seconds
Notice: Applied catalog in 0.09 seconds

but when running the same hiera parameter in a manifest like this

$hieratest = hiera('its',"nothing")
notify { "${hieratest}": }

I get this result

Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for lnx-iapuppet01.iconos.be
Info: Applying configuration version '1471610452'
Notice: nothing
Notice: /Stage[main]/Main/Node[server.domain.be]/Notify[nothing]/message: defined 'message' as 'nothing'
Notice: Applied catalog in 7.74 seconds

Puppetserver can't seem to find the its vault item, but puppet apply can

[jsok]

Can you turn up the verbosity on puppet using --verbose --debug so hiera emits the debug level logs too?

[velocity303]

I had this same issue, but it was resolved when I made sure that vault-ruby was downgraded to the minimum version supported which was 0.4 instead of the latest version 0.7.3. After doing this, it worked like a charm with both puppet apply and puppet agent on Puppet Enterprise 2016.5. Not sure if it will help you, but its worth a shot. @drdam02

[jovandeginste]

@velocity303 @drdam02 if you're running puppet server, you may want to enable the ruby-2 compatibility (which gives you the option to upgrade the vault gem to latest)

• With puppet 4:
  In puppetserver.conf, add this in the section jruby-puppet:
  compat-version: 2.0
• With puppet 5:
  In /etc/sysconfig/puppetserver, add this line:
  JRUBY_JAR=/opt/puppetlabs/server/apps/puppetserver/jruby-9k.jar